Re: Data Recovery/Forensics

On Thu, Oct 30, 2003 at 07:02:37AM -0600, Peter Amisano wrote:
> When imaging a piece of media using DD, will the subject device be written
> to in any way?  Are there other methods of imaging a device other than DD?
Well, the dd itself will not trigger a write to the media you are imaging from,
but if you're pulling from any sort of modern hard disk, the drive in question
could theoretically decide to do a block or sector remapping which does change
the raw data on the platters.  Also, if your drive has SMART (practically
everything in the last 5-6 years?), data such as power-on time and power-cycle
count can be logged.

But no, dd will not alter what the host controller sees as the drive's data.
-- 
Bryon Roche
Professional {Developer,Guru,Mad Scientist}
<kain-NqcGkw6OfHE@xxxxxxxxxxxxxxxx>
PGP Key Fingerprint: FE0D EC23 6464 726A CD54  48D3 04AD 86FE 6878 ABD5
Success, recognition, and conformity are the bywords of the modern world where
everyone seems to crave the anesthetizing security of being identified with the
majority...Human salvation lies in the hands of the creatively maladjusted.
  -- Martin Luther King, Jr.

pgp2Afn5U9YvY.pgp
Description: PGP signature